DNSSec Zone TrustAnchors

I started to see this error as I moved servers in my test environment to Windows 2008 R2.

Alert

Name

DNS 2008 Monitor Zone Resolution Alert

Description

Zone TrustAnchors on DNS Server VDC01.Cosiris.local is not responding to queries.

Source

TrustAnchors (VDC01.Cosiris.local)

The MP is DNS 2008 MP v6.0.6480.0 and OpsMgr 2007R2.

I had not seen this before and as i was having some general problems with the test environment I thought that it might be linked. In fact it seems to be a new feature of Windows 2008 R2. A bit of searching brought in some more information on DNSSec (DNS Security).

http://tools.ietf.org/html/draft-ietf-dnsop-dnssec-trust-anchor-03

http://www.dnssec-tools.org/wiki/index.php/Trust_Anchor

http://blogs.technet.com/sseshad/archive/2008/10/30/dnssec-in-windows-7.aspx

DNSSEC in Windows Server 2008 R2

From http://technet.microsoft.com/en-us/library/ee649277(WS.10).aspx

A trust anchor is a preconfigured public key associated with a specific zone. Windows Server 2008 R2 supports the configuration of trust anchors by using DNSKEY resource records.

A validating DNS server must be configured with one or more trust anchors in order to perform validation. At least one trust anchor is required if any DNSSEC data is to be validated by the DNS server. Additional trust anchors can be deployed to support islands of trust. DNS server management tools (DNS Manager and Dnscmd.exe) can be used to locally or remotely view and modify trust anchors. Trust anchors apply only to the zone for which they are configured.

If the DNS server is running on a domain controller, trust anchors are stored in the forest directory partition in Active Directory Domain Services (AD DS) and will be replicated to all domain controllers in the forest. On standalone DNS servers, trust anchors are stored in a file named TrustAnchors.dns in %windir%\System32\DNS.

The reason it shows up as an alert is that it appears to be a DNS zone in Windows 20089 R2. As I am not intending to run DNSSec I just put an override on this alert.

For a 12:47 video on DNSSec and a link to a deployment white paper go to this link http://edge.technet.com/Media/DNS-Security-DNSSec-Overview/.

Ian

Dec 2009

Advertisement

• Posted in: Management Packs ♦ OpsMgr R2 ♦ SCOM ♦ System Center Operations Manager 2007